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Abstract: An protocol of quantum secret sharing between multiparty and multiparty with 
four states is presented. We show that this protocol can make the Trojan horse attack with a 
multi-photon signal, the fake-signal attack with EPR pairs, the attack with single photons, and 
the attack with invisible photons to be nullification. In addition, we also give the upper bounds of 

\& ' the average success probabilities for dishonest agent eavesdropping encryption using the fake-signal 

<^> attack with any two-particle entangled states. 

o : 
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! ^ , Recently we proposed a quantum secret sharing (QSS) protocol between multiparty (m members in group 1) and 
multiparty (n members in group 2) using a sequence of single photons [lj. In our protocol, all members in group 1 
t^. , directly encode their respective keys on the states of single photons via unitary operations, then the last one (the mth 
member of group 1) sends 1/n of the resulting qubits to each of group 2. After each member of group 2 measures 
the photons, the two groups share the secret messages. Unfortunately, Li et al. pointed out that if the mth party 
of group 1 is dishonest, she can obtain secret by substituting a sequence of single photons or a sequence of Einstein- 
Podolsky- Rosen (EPR) pairs generated by himself for the original photons without the detection of the other parties. 
In this paper, we present a protocol of quantum secret sharing between multiparty and multiparty with four states 
' which is an improvement of the one in [l[ and show that this improved protocol can prevent dishonest member from 
this kind cheating. Moreover, the present protocol is also secure against the Trojan horse attack with a multi-photon 
• signal Q , the fake-signal attack with EPR pairs [i| and the attack with invisible photons Q . We also give the upper 
bounds of the average success probabilities for dishonest agent eavesdropping encryption using the fake-signal attack 
■ with any two-particle entangled states. 

I. REVIEW OF THE ORIGINAL QSS PROTOCOL BETWEEN MULTIPARTY AND MULTIPARTY 

WITHOUT ENTANGLEMENT 

s : 

Suppose that there are m (m > 2) and n (n > 2) members in group 1 and group 2, respectively, and Alice 1, Alice 
2, • • • , Alice to, and Bob 1, Bob 2, ■ • • , Bob 77 are their respective all members. Group 1 wants quantum key sharing 
kji ] with group 2 such that neither part of each group nor the combination of a part of group 1 and a part of group 2 
knows the key, but only all members of each group can collaborate to determine what the string (key) is. The original 
QSS protocol between multiparty and multiparty without entanglement [l[ is briefly summarized as follows: 

(Ml) Alice 1 chooses two random nN-bit strings A\ and B\. She encodes each bit a\ of A\ as |'0o 1 6 1 )> where b\ is 
the corresponding bit of B\ , 

l^oo) - |0), 
l^io) = |1>, 
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Then she sends the resulting nA-qubit state l^ 1 ) = ®fe=ilV'a 1 6 1 ) to Alice 2. 

(M2) Alice 2 creates two random niV-bit strings A 2 and B 2 . She applies ao = I = |0)(0| + |1)(1| or o\ = ia y = 
|0)(1| — |1) (0| to each qubit \ijj a ^ b i) of reA-qubit state j* 1 ) according to the corresponding bit of A 2 being or 1, then 
she applies I or H = -^(|0) + |1))(0| + t^(|0) ~ to each qubit of the resulting nTV-qubit state depending on the 

corresponding bit of B 2 being or 1. After that, she sends Alice 3 the resulting nA-qubit state |\I> 2 ) = ® 7 l= 1 \4'a?b 2 ) ■ 

(M3) Alice i does likewise, i = 3, 4, • • • , m. After Alice m finishes her unitary operations on each single photon, she 
sends A-qubit state (E'^Jn 1 |'0a m . b m . ) to Bob I, 1 < I < n. 

(M4) Bob 1, Bob 2, • • • , Bob 77 receive N qubits, and announce this fact, respectively. 
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(M5) Alice 1, Alice 2, • • • , and Alice m publicly announce the strings B\, £?2, • • • , and B m , respectively. 

(M6) Bob I measures each of his qubit \ip a m . l b m . ,) m the Z basis {|0), |1)} (if ©™ = 0) or in the X basis 

{l+> = I") = ( if ©£1^+1 = 1U= + 0, 1, • • • , JV - 1, Z = 1, 2, • • • , n. 

(M7) All Alices select randomly a subset that will serve as a check on Eve's interference, and tell all Bobs the bits 
they choose. In the check procedure, all Alices and Bobs are required to broadcast the values of their checked bits, 
and compare the XOR results of the corresponding bits of checked bits of A\, A%, • • • , A m and the values of the 
corresponding bits of Bob 1, Bob 2, • • • , and Bob n. If more than an acceptable number disagree, they abort this 
round of operation and restart from first step. 

(M8) The XOR results e" =1 (©^ =1 aj lia+ ;) of Bob Z's corresponding bits ®™i< is+i of the remaining bits 

nj s + I of {©" x ai j+l }f- \ {®T=i< j+ 2}fj \ ' " , {e^Wf^o 1 (or ^l^^), ^JolA^b^.J, • , 
^f^l^Pa^ „f>™ + „)) can be used as key bits for secret sharing between all Alices and all Bobs. 
There exist security flaws in this protocol. The details are as follows. 

1. Alice 1 is a dishonest agent. Alice 1 prepares nN EPR pairs in the state 8^1**), where |$ fc ) = ^(|00) + 

|H))-BA- Alice 1 holds particle E of each EPR pair and sends the sequence Sa of ®k=i\^k) to Alice 2. She does not 
intercept Sa until Sa is sent to Alice + 1 (or Bobs). Note that after all operations of Alice 2, • • • , and Alice i\ (or 
Alice to), is transformed into one of the states 



i$+>, 1*-), -4(i*n + id*-) - (2) 



which are mutually orthogonal. Here 



|$±) = ^(|00) ± |11)), = ^(|01) ± |10». (3) 

Since orthogonal states can be distinguish with certainty, Alice 1 never makes a mistake and can steal encoding 
information of Alice 2, • • • , and Alice i\ (or all Alices) freely and fully. In this way, Alice 1 can steal all Alices 
encryption fully and freely. After that, whether Alice 1 sends Bobs single photons or she sends Bobs EPR pairs, she 
and all Bobs share successfully the secret messages shared by all Alices and all Bobs. 

2. Alice i (1 < «o < m ) is a dishonest agent. Alice i generates nN EPR pairs in the state ®Jj£fjJ<I>fc) as above 
Alice 1, where |$fc) = -L(|00) + \11))ea- When all Alices complete their respective operations in (M1)-(M3), Alice 

io intercepts l^/" 1 ), substitute Sa for |4' m ), and sends N particles of the sequence Sa of ®££jj3>fc) to each Bob I. 
Alice io can obtain the original secret message by cheating without the detection of other parties, which is the same 
as Alice to using the attack with EPR pairs in [3] . 

However, all the weaknesses above can be avoided by the following improved QSS protocol. 



II. THE IMPROVEMENT OF QSS PROTOCOL BETWEEN MULTIPARTY AND MULTIPARTY 

WITHOUT ENTANGLEMENT 

Now we give the improved quantum secret sharing scheme as follows. 

Ml. Alice 1 begins with two random classical bit strings A\ = {a\, a\, ■ ■ ■ , a„jy} and B\ — {b\, b\, • • • , b^ N }, where 
a\ and b\ are uniformly chosen from {0, 1}. She then encodes these strings as a block of nN qubits, 

= <=~oV< J+1 ^^l^. +2 ^.^ • • • l^< J+ „^. + „), 

(4) 

where a\ is the /cth bit of A\ (and similar for Bi), each qubit \<ij) a i b i) is in one of the four states in Eq.JT]). The 
value of b\ determines the basis. If b\ is then a\ is encoded in the Z basis {|0), |1)}; if b\ is 1 then a\ is encoded 
in the X basis {|+) = ^75^, |— ) = ~^^}- Because the four states are not all mutually orthogonal, therefore no 
measurement can distinguish between all of them with certainty. Alice 1 then sends l^ 1 ) to Alice 2 over their public 
quantum communication channel. 

M2. When Alice i receives signals sent by Alice i — 1, she selects randomly a large subset of photons as the samples 
for eavesdropping check. First, she use a special filter to prevent the invisible photons from entering the operation 
system. Then she splits each sample signal with a photon number splitter (PNS: 50/50), and measures each signal 
in the measurement basis (MB) Z, or X at random [3j. Evidently if two photons in one signal are detected, then 
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Alice i will abort the communication. Moreover, she asks Alice 1, Alice 2, • • • , Alice i — 1 to tell her their encoding 
information a s , 6* of the samples in a random sequential order. After that, she analyzes the error rate e s of the 
samples she measured in MB Z or X if ffiJZ^fo* = or 1, respectively. In other words, Alice i analyzes the error rate 
e s of the samples she measured in the same basis with |V' i - 1 &*- 1 )- If the error rate of the samples is higher than a 
threshold e r , then Alice i aborts the quantum communication. Otherwise she goes ahead. Here s is the label of the 
sample chosen for eavesdropping check, and i = 2, 3, • • • , m. 

Clearly the test steps can avoid the Trojan horse attack with a multi-photon signal Q and the attack with invisible 
photons @. 

M3. Alice i creates a quaternary string Ai — {a\,a\,--- T a nj^ +m i-i} and a binary string Bi = 
{b\,b\,--- ,^jv +m i-i}, where a\ and b\ are uniformly chosen from {0,1,2,3} and {0,1}, respectively. For each 
|^ a >-i;,*-i) of the nN + m 4_1 qubit state = <8>™J^ +m IVy-V -1 ) > sne performs the operation er , ci, 02 or 

03 on it depending on the corresponding a\ of is 0, 1, 2 or 3, respectively. Simultaneously she has to operate the 
qubit with J or a Hadamard operator H according to the bit b\ in Bi is or 1, respectively. Here 

a =/=|0>(0| + |l>(l|, 

( T 1 =i < 7, = -|l)(0| + |0)(l|, 

ff2 = o-, = |0)(0|-|l)(l|, 
a 3 = a x = |0)(l| + |l)(0|, 

ff=-L(|Q) + |l))(0| + -L(|0)-|l))(l|. (5) 

Alice i making these unitary operations is equal to the encryption on the states of single photons. The resulting 
state of this qubit is denoted by \ip a i b i). After that Alice i inserts randomly m l — m 4-1 decoy single photons into 
nJV + m'" 1 photons encoded by her, where each of the decoy single photons is randomly in one of the states in Eq.(fT]). 
Here i — 2, 3, • • • , m. 

M4. Alice i sends the photons (nN+m* qubits in the state = <X)™J^ +m * \i/j a i bi )) to Alice i+1 (i = 2, 3, • • • , m-1). 
After Alice m completes her encoding operations and randomly inserts m m — rn m_1 decoy single photons, she sends 
nN + m m photons to Bob 1, Bob 2, • • • , Bob n in a sequential order. 

M5. When all Bob 1, Bob 2, • • ■ , and Bob n have received their respective strings of qubits, each of them first 
randomly and independently chooses sufficient samples to make measurement in MB Z , or X randomly. Then they 
ask Alice 1, Alice 2, • • • , and Alice m to announce publicly the a l s , b\ , of the samples in a random sequential order. 
Here i — 1, 2, • • • , m. After that all Bobs publish their measurement outcomes and the MBs. If the error rate of the 
samples is higher than a threshold, then they abort the quantum communication. Otherwise they go to the next step. 

M6. All Alices ask all Bobs to delete the decoy qubits which are not chosen for eavesdropping check. All members 
in group 1 publicly announce the strings B\, B2, ■ ■ ■ , B m in a random sequential order. 

M7. Bob I (I = 1, 2, • • • , n) measures each of their qubits with the MB Z or X according to the XOR results of the 
corresponding bits in the strings Bi,B%, ■ • ■ , B m . That is, Bob I measures \ip a m. b m . ) m the Z basis if ©£L-,6^ ■ , , = 

Tlj-\-l 7lj-\-l J I 

or in the X basis if ©^a&l^ :+l = 1. From his measurement on |^ ™. ; ), he obtains the outcome d n j + i, which is 
or 1, corresponding to the +1 and —1 eigenstates of a x and <j z . 

M8. All members in group 1 complete the error rate analysis of the transmission between the two groups. To this 
end, all Alices require each of the member in group 2 to publish a subset of the measurement results chosen randomly, 
and analyze the error rates of the samples. If the channel is secure, the XOR results of measurement outcomes of Bob 
1, Bob 2, • • • , and Bob n's corresponding bits can be used as key bits for secret sharing, otherwise they discard the 
results obtained and re-try the quantum communication from the beginning. 



III. SECURITY 

Obviously, the test in M2 can make the attack with invisible photons 0] and the Trojan horse attack Q to be 
nullification. The checking procedure in M5 can avoid the attack with single photons and the attack with EPR pairs 
Q. The fake-signal attack with EPR pairs Q can be detected by the operations in M3 and the check in M2 and M5. 
The security of this present QSS protocol against the attacks in 0, 0] are discussed as follows. 
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A. The security against the attack with single photons and the attack with EPR pairs 

Now, we show that the attack stated in Ref. is easily detected in the present quantum secret sharing. 

Apparently, Bob's measurements on the checked samples collapse them into the states ( in Eq.([T]) ) of single photons. 
In other words, all Bob's measurements on the checked samples remove the entanglements between checked photons 
and other eavesdropping particles, which corresponds to that the attacker Alice iq sends Bobs single quantum states 
in Eq.([T]) whether in the attack with EPR pairs or in the attack with single photons [2|. Thus, all Alices and all 
Bobs can find out the attacker in the attack with single photons via all Alices' publishing their respective encoding 
information in a random sequential order. Since Bob I asks Alices to announce a\ and b l s in a random sequential order, 
the attacker will not be the last one to answer the Bob Vs enquiry with a probability Z2=i. If there is an Alice to be 
asked after the attacker Alice io, Alice io can only guess a l ° and b l ° to answer the inquiry as she can not distinguish 
the quantum state intercepted by her with certainty. It is easy to derive that the error rate of the samples that Bobs 
measured in MB Z or X according to ® r [^ib l s —Q or 1 is more than 

B. The security against the fake-signal attack with EPR pairs 

The present QSS protocol is secure against any dishonest agent eavesdropping secret using the fake-signal attack 
with EPR pairs We shall actually show that this protocol is secure against more general attack, the fake-signal 
attack with any two-particle entangled states (general EPR pairs). Next let us see how this works in detail. 

Suppose that the malicious party Alice io who may be any dishonest one of Alices, generates nN + m %a general 
EPR pairs in the state gS^ 4 "" 1 ' \<j>k), where 

\fa) = \<t>) = \0)A\a) E + \l)A\P)E, (6) 
\o)e and \/3)e are unnormalized states of the 5- level (S > 2) particle E. Note that when 

(a\p) = ((3\a)=0,(a\a) = (f3\fl) = ~, (7) 

\4>k) = 10) is an EPR pair, that is, EPR pair is the special case of \<j>). Alice io replaces each of the original single 
photons |\l/ 10 ) with a fake signal, the general EPR pair \4>k) and sends the sequence Sa of nN + m %a particles A in 

®fc=i +m °l0fc) to Alice i + 1 while each particle E in ®fc^ 1 fm O |0fc) is held by herself. If \<f>) is not a two-particle 
maximally entangled state, then the cheating of Alice io can be found by Alice io + 1 in M2, because Alice io can 
not distinguish between \a) and \/3) and between \a) + \(3) and \a) — \(3) perfectly, it is a certain that Alice io makes 
mistakes. Next we only assume that \<fr) is an EPR pair. Alice io + 1 in the step M2 cannot detect this cheating as 
Alice io is able to produce no errors in the results if Alice io is asked to announce her encryption a\° and b l ° of the 
samples after Alice 1, • • • , Alice io — 1. But if Alice io is not the last to announce her encoding information, then 
her cheating introduces errors and can be found out by Alice io + 1 in M2 without fail. However, when the dishonest 
Alice io is Alice 1, this cheating of her cannot be found out by Alice 2 as it does not introduce errors in the results. 

Alice 1 intercepts Sa while it was sent to Alice i% (2 < i\ < m) or Bobs (evidently, if Alice 1 never intercepts Sa, 
then she can not obtain any information, though this kind of eavesdropping can not be found in the eavesdropping 
check. So it does not make any sense for Alice 1 to do this kind of eavesdropping ). Note that the result of the 
encryptions by Alice 2, • • • , Alice i\ — 1 or Alice m in step M3 is equivalent to one Alice's operations in M3 (that is, 
one Alice performs one of operations <toj &ii &2, 03, H(Tq, Hai, Hfj2 1 Ha^ on each particle A). This is because of 
Ho\H = — o"i, HU2H = (T3, Ha^H = 02, H 2 = <j\ = I, a u a v = —a v a u for u, v = 1, 2, 3. 

The object of Eve is to get all Alices' encoding information Ai and Bi . Therefore, Alice 1 must manage to distinguish 
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= CTo|0; = 




= o-i|0> = 




= o 2 \4>) = 


\fi) 


= O"3|0) = 






l<Ai) 


= #CTll0) 


1^7) 


= ^0- 2 \<j>) 


\<Ps) 


= Ha 3 \ ( f>} 



the eight operations <tq, a±, a 2 , 03, ffcroi -H^i, ^02, and iJ(T3 with which \<fi) is transformed into one of eight states 

|0>|a) + |l>|/3>, 

+ 10)1/3), 
|0>1«> — 11>|j9>, 
|l)l«) + |0)|/3), 

= -L(|0) + |l))|a) + i(|0)-|l))| i 9), 
= --L(|0)-|l))|a) + -^(|0) + |l))|/9), 
= -L(|0) + |l))|a)-i(|0)-|l))| i 9), 

= -L(|0)-|l))|a) + i(|0) + |l)M, (8) 

where |0) is an EPR pair (i.e. \a) and |/3) satisfy Eq.(|7J)). In other words, she is to distinguish the eight states. The 
eight states in Eq.© belongs to the subspace W of the entire Hilbert space H spanned by |0)|a), |0)|/3), |l)|a) and 
1 1)|/3). Obviously, the dimension dinuH 7 of subspace W is less than or equal to 4. It implies that it is impossible for 
all eight states in Eq. ((SJ) being mutually orthogonal, so these eight states can not be reliably distinguished 6] . Thus 
Alice l's eavesdropping can be detected in M2 by Alice i\ or M5 by all Bobs. Therefore the fake-signal attack with 
EPR pairs can not work for the present quantum secret sharing protocol. 

On the other hand, in the present protocol, Alices insert randomly decoy single photons into the signal photons in 
M3. The eavesdropping check on the decoy single photons is the same as that on the signal photons. That is, first 
Alice i measures (or all Bobs measure) each decoy single photon in MB Z, or X at random, then she asks (they ask) 
Alice 1, Alice 2, • • • , Alice i — 1 (all Alices) to tell her (them) their encoding information a*, 6' of the samples in a 
random sequential order. Note that there is at least one honest agent in one communication group. Therefore the 
dishonest agent can be found by the eavesdropping checks on the decoy photons by the honest agents. The principle 
of the checking procedures is the same as that in BB84 quantum key distribution protocol @ . 

Remark 1. If only Alice 2 is honest in group 1, and all Alices except Alice 2 collude, the cheating of Alice 1 can be 
found out by all Bobs in the step M5. 

Remark 2. Alice 1 can not unambiguously discriminate four sets 

{\<Pll), \<P12}}, {\<p2l), \<P22)}, {\<P3l), \<P32}}, {|V4l), 1^42)}, 

(9) 

where 



= \<Pi), ^12) = 1^5), \<P2i) = ba>, ^22) = |<A>), 

|<P3l) = 1^3), 1^32) = \<P7), \<P4l) = \<P4,), 1^42) = |¥>8>- 

(10) 

This will be given later. Even if Alice 1 can correctly classify the four sets in ([9]), she will be detected in the step M2 
by Alice i\ or in the step M5 by all Bobs as she produces errors when answering Alice i\ or all Bobs' enquiry. 

Remark 3. It is not necessary for Alice i (2 < i < m) performing four operations cto, a±, a 2 and CT3 in M3. In fact, 
Alice i only needs to use three operations either erg, ci, 02 or <tq, o\, (T3. 

Next we will calculate the upper bounds of the average success probabilities of the two cases, one is to distinguish 
the eight states in Eq.©, the other is to classify the four sets in where \(j>) is a two-particle entangled state. 

Case I. The upper bound of the average success probability distinguishing the eight states in Eq.©. Let 

x = (a\0) + (P\a), 

q = j«a|/3) - G9|a», 
z = (a\a), 
t = {0\0), 

z + t = l, (11) 
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we have 



i+3 



\q\ + 8\z -t\+ 8\x\ + —j=\z -t + x\ 

-—\ z -t-x\ + -j=y/l + ?. (12) 



It follows that minimum of \ {fi\<Pj}\ can be realized if 



q = 0,z = t=^,x = Q. (13) 



It means that the minimum of XXi=i \ ( l fii\ ( Pj) \ occurs when \<j>f.) is an EPR pair. 
The minimum of X^-j=i K^ilVj)! i s 

16 



(14) 



MmY, \{<Pi\<Pi)\ = -ft 

i¥=3 

The average success probability Pi 7] for unambiguous identification of the eight states in Eq. ([SJ satisfies 

1 8 

Pi< i - M _ 1 51 VMJK^I^)! 

- I 1 x 16 

~ 56 X 71 

= 1-^<1, (15) 

where M — 8 is the number of the states to be distinguished, pi — | and p 3 = | are the prior probabilities of \ipi) 
and | tjCj ) , respectively. 

Case II. The upper bound of the average success probability classifying the four sets in Eq.©. By calculation, we 
obtain that 



Y Y \ 7Tt TTtTr tK<Pik\<Pjl)\ 

C^ lk %\ (N-m t )(N- mj ) 



= ( S£V(8-2)x(8-2)l<^'>l 

+ ±^YTf + 2\x\ + ^=\z-t + x\). (16) 

Here N = 8 is the total number of the states in the four classified sets in m, is the number of the states of the 
j-th set, and rjih is the prior probability of \(fik)- 
A little thought shows that 
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and the equality holds if 



x = 0,z = t = i,g = 0, (18) 



that is, the minimum of J2hj=i 12k,i=i J (N-Z\)(N-m ) 1(^1^)1 reaches when \<f>) is an EPR pair. 
The average success probability P2 of conclusive quantum states sets classification [8j is 



= l-f<l. (19) 

From (|15p and (fH?)) . no matter what kind strategy the malicious Alice i$ use, she will disturb the quantum system, 
make mistakes, and therefore can be detected in M2, M5 and M8. Consequently, the present QSS protocol is secure not 
only against the fake-signal attacking with EPR pairs but also against the fake-signal attacking with any two-particle 
entangled states — general EPR pairs. 

This present QSS protocol is an improvement of original QSS protocol In the present QSS protocol, we add 
the special filters, photon number splitters, single-photon detectors, the eavesdropping check of each member Alice i 
(i = 2, 3, • • • , m) in group 1, decoy single photons, two operations a x and a z , and the random measurements of all 
Bobs on their respective qubits chosen at random. It is the improvement that makes the attacks pointed in 0, H, 0, HJ 
to be of no effect (to be nullification). The principle of the checking procedures is the same as that in BB84 quantum 
key distribution protocol. So the transmission of qubits between authorized members in the two groups is secure. 
That is, the present QSS protocol between multiparty and multiparty with four states is secure. 
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